The vulnerability is a missing authorization check in the Chrome Network module that allows a remote attacker, using a social‑engineering approach and crafted network traffic, to bypass the browser’s web origin policy. The flaw is not a direct code‑execution bug but breaks a core security boundary that normally restricts cross‑origin communication.

Affected systems are Google Chrome browsers running any release prior to version 155.0.8059.39. The issue is present in the mainstream desktop releases for all supported operating systems, and it applies to every installation of Chrome that has not yet been updated to the patched release.

The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation to date. The attack requires an attacker to craft malicious network traffic and convince a user to interact with it, suggesting that social engineering is a required component. The reported Chromium severity is low, and a CVSS score of 6.5 reflects moderate risk; however, because it breaks the essential origin‑policy boundary, the potential for significant data exposure remains when the threat is realized.